NocoDB Uncontrolled Resource Consumption via Bulk Write Routes

Executive Summary

NocoDB before version 2026.09.0 has an uncontrolled resource consumption vulnerability. Authenticated users with Editor write permissions can bypass bulk row-count limits by using session authentication instead of API tokens. This allows attackers to submit hundreds of thousands of rows to bulk write routes, consuming database connections, CPU, and memory resources.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high database connection counts, CPU, or memory usage from NocoDB bulk operations. Check NocoDB logs for repeated large bulk write requests (v1/v2 routes) from session-authenticated users with Editor permissions. Use network traffic analysis to detect excessive data submission to /api/v1/db/data/bulk and /api/v2/db/data/bulk endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service by exhausting database resources, causing system slowdowns or crashes. It may also result in bulk data pollution if attackers repeatedly send large requests. The impact depends on the attacker's permissions and the system's resource limits.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NocoDB to version 2026.09.0 or later. Implement rate limiting on bulk write endpoints. Restrict Editor write permissions to only necessary users. Monitor and block excessive bulk operations from session-authenticated requests. Review and enforce row-count limits server-side for all authentication methods.

Useful 0 Not Useful 0